tokenpocket[.]ru

This domain, tokenpocket.ru, is identified as a brand impersonation threat targeting users of the OKX cryptocurrency exchange and wallet service. The site presents itself as a universal digital wallet supporting multiple blockchains, including BTC, ETH, BSC, HECO, and TRON, with a Russian-language interface. Analysis indicates the domain is designed to harvest user credentials, private keys, or recovery phrases under the guise of a legitimate wallet service, potentially leading to unauthorized access and asset theft from victim accounts. Infrastructure analysis reveals the domain was registered on January 02, 2021, through REGRU-RU, and currently resolves to the IP address 172.67.201.16. The site employs a Google Trust Services SSL certificate, which may lend a false sense of legitimacy to unsuspecting users. Detection metrics show that 3 out of 95 security vendors on VirusTotal flag this domain as malicious, while it appears on 3 distinct security blocklists. Technologies detected on the site include WordPress, MySQL, PHP, and analytics tools such as Yandex.Metrika, suggesting a structured and potentially scalable phishing operation. Users who have visited tokenpocket.ru or entered sensitive information on the site should immediately cease all interaction and take corrective actions. This includes revoking access to any connected applications or browser extensions, rotating all cryptocurrency wallet credentials, and monitoring target accounts for unauthorized transactions. If private keys or recovery phrases were exposed, users should transfer assets to a new, secure wallet. Additionally, affected individuals should report the incident to relevant security teams and consider implementing additional authentication measures for enhanced protection.